- Test - lists.nanog.org

Re: [Patching for Cisco vulnerability]
by Joshua Sahala 18 Jul '03

18 Jul '03

"Irwin Lazar" <ILazar(a)burtongroup.com> wrote: > > Just out of curiosity, are folks just applying the Cisco patch or do you go > through some sort of testing/validation process to ensure that the patch > doesn't cause any other problems? Given typical change management > procedures how long is taking you to get clearance to apply the patch? > > I'm trying here to gauge the length of time before this vulnerability is closed out. > > irwin > it will be 'closed' probably about the same time that code red goes away....there will be routers sitting somewhere that are not upgraded (whether due to insufficient hardware or skill or because they are in storage). yes the publicity will help, but there is/was a lot of publicity other exploits/holes, and they are still there. /joshua "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

RE: Patching for Cisco vulnerability
by Dan Lockwood 18 Jul '03

18 Jul '03

What kind of testing protocol do providers have in place to test IOS images prior to deployment. I have never been exposed to those processes and am curious to understand what takes place as a BCP. Dan -----Original Message----- From: Jared Mauch [mailto:jared@puck.Nether.net] Sent: Friday, July 18, 2003 12:05 To: Irwin Lazar Cc: nanog(a)merit.edu Subject: Re: Patching for Cisco vulnerability On Fri, Jul 18, 2003 at 12:29:30PM -0600, Irwin Lazar wrote: > > Just out of curiosity, are folks just applying the Cisco patch or do > you go through some sort of testing/validation process to ensure that > the patch doesn't cause any other problems? Given typical change > management procedures how long is taking you to get clearance to apply > the patch? > > I'm trying here to gauge the length of time before this vulnerability > is closed out. most providers can easily go from (for example) 12.0(21)S3 to 12.0(21)S7 with less testing than from 12.0(21)S to 12.0(25)S The hurdles are still there to maintain the necessary customer notifications, etc.. but aside from that, I think the press is doing their job (good or bad) in that most customers are aware that there's something bad going on and people are moving to protect the internet infrastructure. - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

BGP flap dampening considered harmful
by Sean Donelan 18 Jul '03

18 Jul '03

Providers which aggressively flap dampen routes may want to consider periodically clearing their dampened routes over the next few days. A lot of providers are changing routes, and sometimes its the intermediate providers reloading their routers causing the flaps. It seems some people dampen some routes for hours after they've been restored.

1 0

after Cisco IOS exploit patch
by Saxon Jones 18 Jul '03

18 Jul '03

After I upgraded my IOS this morning I've seen 13,844 input errors on the port; when looking at the switch the router is connected to I see that a very similar number of multi-cast packets (13,423). Has anyone else seen this? Is this perhaps what the patch does (register exploit packets as input errors)? FastEthernet0/0 is up, line protocol is up Hardware is DEC21140A, address is 0002.1723.0800 (bia 0002.1723.0800) Internet address is 199.185.131.249/24 MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 106/255, rxload 118/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, 100BaseTX/FX ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/53/231 (size/max/drops/flushes); Total output drops: 733 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 46298000 bits/sec, 9642 packets/sec 5 minute output rate 41710000 bits/sec, 8891 packets/sec 163709405 packets input, 2006456215 bytes Received 11374 broadcasts, 0 runts, 0 giants, 2 throttles 13844 input errors, 0 CRC, 0 frame, 0 overrun, 13182 ignored 0 watchdog 0 input packets with dribble condition detected 157777703 packets output, 1121349334 bytes, 0 underruns 0 output errors, 0 collisions, 2 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out FastEthernet8 is up Hardware is FastEthernet, address is 00e0.5202.4613 (bia 00e0.5202.4613) Configured speed 100Mbit, actual 100Mbit, configured duplex fdx, actual fdx Member of L2 VLAN ID 1, port is untagged, port state is FORWARDING STP configured to OFF, priority is high, flow control enabled mirror disabled, monitor disabled Not member of any active trunks Not member of any configured trunks No port name 5 minute input rate: 43045336 bits/sec, 8985 packets/sec, 44.47% utilization 5 minute output rate: 46621104 bits/sec, 9711 packets/sec, 48.16% utilization 689714869 packets input, 3817420687 bytes, 0 no buffer Received 4493 broadcasts, 0 runts, 0 giants 5 input errors, 5 CRC, 0 frame, 0 ignored 13423 multicast 736196013 packets output, 1836390208 bytes, 0 underruns 0 output errors, 0 collisions ________________________ saxon jones network infrastructure admin interbaun communications suite 200 18404 stony plain road edmonton, ab T5S 2M8 <mailto:netadmin@interbaun.net> mailto:netadmin@interbaun.net <http://www.interbaun.com/> http://www.interbaun.com/ (780) 447-8276

2 1

Cisco DoS exploits in the wild?
by Scott Waddell 18 Jul '03

18 Jul '03

Hi all, Is anyone seeing active exploits of the latest Cisco DoS now that exploit code is public? The following article claims that attacks have been reported: http://biz.yahoo.com/djus/030718/1136000519_2.html Thanks, Scott __ Scott Waddell Global Defense & Space Group Cisco Systems, Inc. swaddell(a)cisco.com

2 1

RE: Cisco exploit and Huawei
by Martin, Christian 18 Jul '03

18 Jul '03

Now that would be quite telling - and may put the nail in the antitrust coffin! Chris >-----Original Message----- >From: Rubens Kuhl Jr. [mailto:rubens@email.com] >Sent: Friday, July 18, 2003 10:44 AM >To: nanog(a)merit.edu >Subject: Cisco exploit and Huawei > > > > >It would be interesting to know if Huawei routers also falls >to the Cisco IOS exploit... > > >Rubens > >

1 0

Re: Cisco exploit and Huawei
by Rubens Kuhl Jr. 18 Jul '03

18 Jul '03

As listed on the advisory, e-maiing tac(a)cisco.com. A "show tech" and the chassis S/N on the front mail will help expedite the process... Rubens ----- Original Message ----- From: "Vincent Poy" <vince(a)oahu.WURLDLINK.NET> To: "Rubens Kuhl Jr." <rubens(a)email.com> Cc: <nanog(a)merit.edu> Sent: Friday, July 18, 2003 12:01 PM Subject: Re: Cisco exploit and Huawei | Speaking about the patches, how does one get the patches if they | don't have a support contract with Cisco? | | | Cheers, | Vince - vince(a)WURLDLINK.NET - Vice President ________ __ ____ | Unix Networking Operations - FreeBSD-Real Unix for Free / / / / | / [__ ] | WurldLink Corporation / / / / | / | __] ] | San Francisco - Honolulu - Hong Kong / / / / / |/ / | __] ] | HongKong Stars/Gravis UltraSound Mailing Lists Admin /_/_/_/_/|___/|_|[____] | Almighty1@IRC - oahu.DAL.NET Hawaii's DALnet IRC Network Server Admin |

1 0

ATT Contact
by Hunter Pine 18 Jul '03

18 Jul '03

Anyone have an AT&T Project Management/Provisioning contact in NYC who can get things done? I've got a circuit that's been waiting 2 weeks for a smartjack and it's getting towards crunch time with no smartjack. Thanks in advance, Hunter

1 0

new list - procket-nsp
by Jared Mauch 18 Jul '03

18 Jul '03

Greetings, Quick note and i'll leave you to your regularly scheduled discussions of another vendor software bugs for the day :) I have created a new mailing list on my system, procket-nsp. It is meant to be the counterpart for the other -nsp lists that are hosted already (cisco, foundry, juniper) the system. To subscribe please visit: http://puck.nether.net/mailman/listinfo/procket-nsp For other lists, just change the url as follows: http://puck.nether.net/mailman/listinfo - Jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

Re:AOL MAIL BLOCKING
by nanog＠cfsdigital.com 18 Jul '03

18 Jul '03

Sorry about the wrong url its http://postmaster.info.aol.com/

1 0